Updated: 8 October 2026 · Applies to: Ubuntu 24.04 (apt 2.8.3), Ubuntu 26.04 (apt 3.2.0) and Debian 13 (apt 3.0.3); dnf section tested on AlmaLinux 10.2 (dnf 4.20.0)

List the versions apt can see, then install one with package=version, using the exact version string from the list. If the package has companion packages built from the same source, give them the same version, then hold them so the next upgrade does not replace them:

apt-cache policy nginx
sudo apt install nginx=1.24.0-2ubuntu7 nginx-common=1.24.0-2ubuntu7
sudo apt-mark hold nginx nginx-common

The examples use nginx on Ubuntu 24.04. The same commands work for any package on Ubuntu and Debian.

Step 1: See which versions are available

$ sudo apt update
$ apt-cache policy nginx
nginx:
  Installed: (none)
  Candidate: 1.24.0-2ubuntu7.18
  Version table:
     1.24.0-2ubuntu7.18 500
        500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
     1.24.0-2ubuntu7 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages

Candidate is what a plain apt install nginx would pick. Ubuntu keeps the original release version (noble) and the latest update (noble-updates and noble-security). Two shorter views of the same list:

$ apt list -a nginx
nginx/noble-updates,noble-security 1.24.0-2ubuntu7.18 amd64
nginx/noble 1.24.0-2ubuntu7 amd64

$ apt-cache madison nginx

Use the full version string, including the part after the hyphen. A version that is not in your repositories fails straight away:

E: Version '1.22.0' for 'nginx' was not found

Step 2: Install that version

Asking for nginx alone fails, because nginx needs the exact same version of nginx-common:

$ sudo apt install nginx=1.24.0-2ubuntu7
The following packages have unmet dependencies:
 nginx : Depends: nginx-common (= 1.24.0-2ubuntu7) but 1.24.0-2ubuntu7.18 is to be installed
E: Unable to correct problems, you have held broken packages.

On Ubuntu 26.04 the same problem reads Error: Unable to satisfy dependencies. Reached two conflicting assignments. Find the packages that need a matching version in the Depends line, then name them all:

$ apt-cache show nginx=1.24.0-2ubuntu7 | grep ^Depends
$ sudo apt install nginx=1.24.0-2ubuntu7 nginx-common=1.24.0-2ubuntu7
$ nginx -v
nginx version: nginx/1.24.0 (Ubuntu)

Step 3: Hold the package so upgrades skip it

$ sudo apt-mark hold nginx nginx-common
nginx set on hold.
nginx-common set on hold.
$ apt-mark showhold
nginx
nginx-common

apt upgrade now leaves them alone. Ubuntu 24.04 reports The following packages have been kept back: nginx nginx-common; Ubuntu 26.04 lists them under Not upgrading:. To release the hold: sudo apt-mark unhold nginx nginx-common.

A held package gets no security updates. In this example the newer 1.24.0-2ubuntu7.18 comes from noble-security, so hold only for a reason and check regularly. For other ways to block updates, see How to lock or blacklist package updates with apt.

Downgrade to an older version

Use the same package=version syntax. apt shows the packages under "DOWNGRADED" and asks you to confirm. In scripts with -y it refuses unless you add --allow-downgrades:

$ sudo apt-get install -y nginx=1.24.0-2ubuntu7 nginx-common=1.24.0-2ubuntu7
The following packages will be DOWNGRADED:
  nginx nginx-common
0 upgraded, 0 newly installed, 2 downgraded, 0 to remove and 3 not upgraded.
E: Packages were downgraded and -y was used without --allow-downgrades.

$ sudo apt-get install -y --allow-downgrades nginx=1.24.0-2ubuntu7 nginx-common=1.24.0-2ubuntu7
dpkg: warning: downgrading nginx from 1.24.0-2ubuntu7.18 to 1.24.0-2ubuntu7
dpkg: warning: downgrading nginx-common from 1.24.0-2ubuntu7.18 to 1.24.0-2ubuntu7

Back up first. Downgrades are not what packages are tested for, and some software (database servers in particular) cannot use data that a newer version has already converted.

Pin a version with an APT preferences file

A pin is more flexible than a hold. Create /etc/apt/preferences.d/nginx:

Package: nginx nginx-common
Pin: version 1.24.0-2ubuntu7
Pin-Priority: 1001

apt now treats that version as the candidate, and apt upgrade no longer offers nginx:

$ apt-cache policy nginx
nginx:
  Installed: 1.24.0-2ubuntu7
  Candidate: 1.24.0-2ubuntu7
  Version table:
     1.24.0-2ubuntu7.18 500
...
 *** 1.24.0-2ubuntu7 1001

A priority of 1000 or more lets apt downgrade to the pinned version. According to the apt_preferences manual, the version may end in * (for example Pin: version 1.24.0*) to stay on one release series while still getting its updates. Delete the file to undo the pin.

Upgrade one specific package

sudo apt install --only-upgrade nginx nginx-common

This upgrades just those packages to the candidate version. With --only-upgrade, a package that is not installed is skipped (Skipping curl, it is not installed and only upgrades are requested.). If the package is held, unhold it first, or apt stops with Held packages were changed and -y was used without --allow-change-held-packages.

Download a package (.deb) without installing it

$ apt download nginx
$ apt-get download nginx=1.24.0-2ubuntu7 nginx-common=1.24.0-2ubuntu7
$ ls -1
nginx-common_1.24.0-2ubuntu7_all.deb
nginx_1.24.0-2ubuntu7.18_amd64.deb
nginx_1.24.0-2ubuntu7_amd64.deb

Run this as a normal user in a folder you own. As root in /root it still works but prints W: Download is performed unsandboxed as root. To fetch a package and everything it needs into /var/cache/apt/archives/, use sudo apt-get install --download-only curl. Install a downloaded file with sudo apt install ./nginx_1.24.0-2ubuntu7.18_amd64.deb; apt fetches missing dependencies from the repositories. More options: tools to install local .deb packages. To see a package's versions and download links in a web browser, use the package pages, for example nginx on packages.ubuntu.com or nginx on packages.debian.org.

Debian: fewer versions to choose from

Debian 13 keeps only the version from the latest point release and the latest security update:

$ apt-cache policy nginx
...
     1.26.3-3+deb13u9 500
        500 http://deb.debian.org/debian-security trixie-security/main amd64 Packages
     1.26.3-3+deb13u7 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages

Older builds are kept in Debian's snapshot archive (snapshot.debian.org), which lists every nginx version Debian has published. Download the .deb files from there and install them with apt install ./file.deb, then hold them.

AlmaLinux, Rocky Linux and RHEL: dnf install a specific version

$ dnf --showduplicates list nginx
nginx.x86_64     2:1.26.3-6.el10_2.3     appstream
...
nginx.x86_64     2:1.26.3-6.el10_2.7     appstream

$ sudo dnf install nginx-1.26.3-6.el10_2.5
$ sudo dnf downgrade nginx-1.26.3-6.el10_2.3

Unlike apt, dnf downgraded the related nginx-core and nginx-filesystem packages by itself. To hold a version, install the versionlock plugin:

$ sudo dnf install python3-dnf-plugin-versionlock
$ sudo dnf versionlock add nginx nginx-core
Adding versionlock on: nginx-2:1.26.3-6.el10_2.3.*
Adding versionlock on: nginx-core-2:1.26.3-6.el10_2.3.*
$ sudo dnf upgrade nginx
Nothing to do.

Remove it with sudo dnf versionlock delete nginx nginx-core. See also How to install a particular package version in CentOS and Ubuntu and ways to lock or exclude package updates with dnf.

Official documentation: apt-get(8), apt_preferences(5).

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)